Security readout for executives and security teams
Plain-English summary
Dolibarr ERP/CRM 6.0.0 has a reported SQL injection flaw in an administrative menu editing page. If an exposed deployment is vulnerable, an attacker could manipulate database queries and potentially affect business data. The source bundle does not provide CVSS, authentication requirements, or named fixed versions.
Executive priority
Prioritize verification if Dolibarr 6.0.0 is used, because ERP/CRM systems often contain sensitive customer, finance, and operational data. Urgency is evidence-limited: severity, exploit status, and fixed-version details are not included in the supplied sources.
Technical view
CVE-2017-14238 describes SQL injection in `admin/menus/edit.php` in Dolibarr ERP/CRM 6.0.0 through the `menuId` parameter, allowing arbitrary SQL commands. The only referenced vendor evidence is a Dolibarr GitHub commit. No CWE, CVSS vector, or detailed exploit preconditions are provided.
Likely exposure
Exposure is likely limited to organizations running Dolibarr ERP/CRM 6.0.0, especially where the administrative menu edit route is reachable. The supplied sources do not state whether exploitation requires authentication or specific privileges.
Exploitation context
The CVE record says remote attackers can execute arbitrary SQL commands via `menuId`. It is not listed in KEV, and the supplied sources do not show active exploitation, public exploit maturity, or attack complexity details.
Researcher notes
Key gaps are authentication requirements, affected version range beyond 6.0.0, fixed release mapping, and CVSS. Treat the GitHub commit as the primary technical reference, but avoid broader affected-product claims without vendor release notes or additional confirmed sources.
Mitigation direction
- Inventory Dolibarr deployments and identify any running version 6.0.0.
- Review Dolibarr vendor guidance and the referenced commit for the supported fix path.
- Apply a vendor-supported fixed release or patch once confirmed.
- Restrict administrative route exposure to trusted users and networks.
- Back up and monitor ERP/CRM databases during remediation.
Validation and detection
- Confirm whether each Dolibarr instance is version 6.0.0.
- Check whether `admin/menus/edit.php` is present and reachable in deployed systems.
- Verify deployed code includes the vendor change referenced by the CVE.
- Review access logs for unusual requests involving the `menuId` parameter.
- Confirm database integrity and investigate unexplained administrative changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.